Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Added IamRoleRegion to Credential in order to set a custom sts region for sts Client #235

Open
wants to merge 3 commits into
base: master
Choose a base branch
from

Conversation

foglia-prometeia
Copy link

Added iamRoleRegion as attribute in:

  • AmazonWebServicesCredentialsBinding.java
    • updated constructor
    • updated assumeRoleProvider --> in buildStsClient now iamRoleRegion attribute is passed as argument
  • AWSCredentialsImpl.java
    • updated constructor and overloaded for compatibility
    • updated buildStsClient to include iamRoleRegion as parameter --> clientRegion now dynamically switches to determineClientRegion() if iamRoleRegion is null/empty
    • updated getCredentials() --> updated buildStsClient in order to match the updated method
  • credentials.jelly
    • added entry under iamRoleArn for iamRoleRegion as textbox
  • Added help-iamRoleRegion.html for help message

GUI Changes

Before
image

After
image

Testing done

We created this simple use case:

pipeline {
    agent any
    parameters {
        string(name: 'region', defaultValue: "")
        string(name: 'credential', defaultValue: "")
    }
    stages {
        stage('TEST') {
            steps {
                withCredentials([[
                    $class: 'AmazonWebServicesCredentialsBinding',
                    credentialsId: "${params.credential}",
                    accessKeyVariable: 'AWS_ACCESS_KEY_ID',
                    secretKeyVariable: 'AWS_SECRET_ACCESS_KEY'
                ]]) {
                    sh "aws sts get-caller-identity --region ${params.region}"
                }
            }
        }

    }
}

Problem found before iamRoleRegion
Using the provided test over a credential:role we encountered this error "The security token included in the request is invalid" caused by the role being assumed in a different region then the target region for the aws cli operations.
Thus to solve this problem iamRoleRegion has been added to the plugin Credential.

Submitter checklist

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

1 participant